feat(twenty-server): migrate remaining at-rest encryption sites to versioned envelope (#20550)

## Summary Second PR in the encryption key rotation series. The previous PR (#20528) introduced `ENCRYPTION_KEY` + the versioned `enc:v2:<keyId>:<base64>` envelope inside `SecretEncryptionService` and migrated `ConnectedAccountTokenEncryptionService` as the first consumer. This PR routes every remaining at-rest encryption site through the versioned envelope so that `ENCRYPTION_KEY` (and the future `FALLBACK_ENCRYPTION_KEY`) actually covers them. The legacy unprefixed CTR ciphertext remains readable as a fallback during the rollout window — every migrated read site uses `decryptVersioned`, which transparently delegates to the legacy CTR decrypt when it sees an unprefixed payload. ### Service migrations - **`ApplicationVariableEntityService` (#8)** — workspace-scoped. HKDF info is bound to each row's `workspaceId`. A new `decryptAndMaskVersioned` helper lands on `SecretEncryptionService` for the resolver display path. - **`ApplicationRegistrationVariableService` (#7)** + consumers — **instance-scoped**. Registration variables are server-level config readable by every workspace that installs the application, so HKDF info is `instance`. Updated consumers: - `LogicFunctionExecutorService.buildServerVariableEnvMap` - `ConnectionProviderService.getClientCredentials` - **`LogicFunctionExecutorService.buildEnvVar` (#9)** — workspace-scoped. Each variable's `workspaceId` is threaded into `decryptVersioned`, so per-workspace HKDF contexts are honoured at execution time. - **`UpdateApplicationVariableActionHandlerService`** (workspace-migration runner) — threads `workspaceId` through the secret/non-secret toggle. - **`JwtKeyManagerService` (#3)** — instance-scoped. Signing keys are shared across the JWKS. - **`ConfigStorageService` (#6)** — instance-scoped sensitive STRING config variables. ### Slow instance commands (2.5.0) Each migrated site has a paired backfill that re-encrypts existing rows into the v2 envelope before the column is constrained: | timestamp | command | scope | CHECK constraint | |---|---|---|---| | `1798000005000` | encrypt-application-variable | workspaceId | `"isSecret" = false OR value = '' OR value LIKE 'enc:v2:%'` | | `1798000006000` | encrypt-application-registration-variable | instance | `"encryptedValue" = '' OR value LIKE 'enc:v2:%'` | | `1798000007000` | encrypt-signing-key-private-keys | instance | `"privateKey" IS NULL OR value LIKE 'enc:v2:%'` | | `1798000008000` | encrypt-sensitive-config-storage | instance | _none_ — heterogeneous jsonb column | All backfills are idempotent (the SELECT filter skips rows already in v2 form) and run before their respective `up()` adds the CHECK constraint. Every `down()` deliberately stops at dropping the CHECK constraint — they intentionally do not re-introduce plaintext on rollback. ### Tests - Unit specs for each new slow command cover the v2 upgrade path, the idempotency invariant, and the instance vs workspace HKDF scope. - New `JwtKeyManagerService` spec asserts `decryptVersioned`/`encryptVersioned` are called without `workspaceId` (instance scope). - Updated existing specs for `ApplicationVariableEntityService`, `ConfigStorageService`, and `buildEnvVar` to assert the versioned API and the workspace HKDF context plumbing. - New `SecretEncryptionService.decryptAndMaskVersioned` cases in the service spec. - Updated the `applicationRegistrationVariable` integration spec to assert the column now stores `enc:v2:<keyId>:<base64>` instead of raw legacy CTR. ### Out of scope (future PRs) - `PostgresCredentialsService` — bespoke `jwtWrapperService.generateAppSecret`–derived key + `encryptText`/`decryptText` from `auth.util.ts`; deserves its own migration. - `SimpleSecretEncryptionUtil` (TOTP) — entirely different `aes-256-cbc` `iv:enc` format; deserves its own migration. ## Test plan - [x] `npx nx typecheck twenty-server` - [x] `npx nx lint:diff-with-main twenty-server` (oxlint + prettier) - [x] Local jest run for `secret-encryption | connected-account-token | application-variable | application-registration-variable | build-env-var | jwt-key-manager | config-storage | encrypt-application-variable | encrypt-application-registration-variable | encrypt-signing-key | encrypt-sensitive-config-storage` — 17 suites, 106 tests pass. - [x] Local jest run for `upgrade | instance-command` — 12 suites, 86 tests pass. - [ ] CI green - [ ] Manual review of CHECK constraint shapes by a server reviewer (each one matches `enc:v2:%` rather than `enc:v_:%` since none of the migrated columns can legitimately hold `enc:v1:` ciphertext).
2026-05-14 08:10:52 +02:00
parent 04eb913551
commit 7fa136f305
30 changed files with 1815 additions and 63 deletions
@@ -2,6 +2,7 @@ import { Field, ObjectType } from '@nestjs/graphql';

 import { IDField } from '@ptc-org/nestjs-query-graphql';
 import {
+  Check,
  Column,
  CreateDateColumn,
  Entity,
@@ -24,6 +25,13 @@ import { ApplicationRegistrationEntity } from 'src/engine/core-modules/applicati
  'applicationRegistrationId',
 ])
@Index('IDX_APP_REG_VAR_APP_REGISTRATION_ID', ['applicationRegistrationId'])
+// Constrains `encryptedValue` to the unfilled default ('') or to the
+// versioned envelope. Registration variables are instance-scoped so the
+// envelope's HKDF info does not include a workspaceId.
+@Check(
+  'CHK_applicationRegistrationVariable_encryptedValue_encrypted',
+  `"encryptedValue" = '' OR "encryptedValue" LIKE 'enc:v2:%'`,
+)
 export class ApplicationRegistrationVariableEntity {
  @IDField(() => UUIDScalarType)
  @PrimaryGeneratedColumn('uuid')
@@ -46,7 +46,7 @@ export class ApplicationRegistrationVariableService {
      value: variable.isFilled
        ? variable.isSecret
          ? '•••••••••••••'
-          : this.encryptionService.decrypt(variable.encryptedValue)
+          : this.encryptionService.decryptVersioned(variable.encryptedValue)
        : null,
    }));
  }
@@ -60,7 +60,7 @@ export class ApplicationRegistrationVariableService {
      workspaceId,
    );

-    const encryptedValue = this.encryptionService.encrypt(input.value);
+    const encryptedValue = this.encryptionService.encryptVersioned(input.value);

    const variable = this.variableRepository.create({
      applicationRegistrationId: input.applicationRegistrationId,
@@ -98,7 +98,9 @@ export class ApplicationRegistrationVariableService {
    const updateData: Record<string, unknown> = {};

    if (isDefined(update.value)) {
-      updateData.encryptedValue = this.encryptionService.encrypt(update.value);
+      updateData.encryptedValue = this.encryptionService.encryptVersioned(
+        update.value,
+      );
    }

    if (isDefined(update.resetValue) && update.resetValue) {
@@ -39,17 +39,23 @@ describe('ApplicationVariableEntityService', () => {
        {
          provide: SecretEncryptionService,
          useValue: {
-            encrypt: jest.fn((value: string) => `encrypted_${value}`),
-            decrypt: jest.fn((value: string) =>
-              value.replace('encrypted_', ''),
+            encryptVersioned: jest.fn(
+              (value: string, opts?: { workspaceId?: string }) =>
+                `enc:v2:deadbeef:${value}|${opts?.workspaceId ?? 'instance'}`,
            ),
-            decryptAndMask: jest.fn(
+            decryptVersioned: jest.fn(
+              (value: string, _opts?: { workspaceId?: string }) =>
+                value.replace(/^enc:v2:[0-9a-f]+:/, '').replace(/\|.*$/, ''),
+            ),
+            decryptAndMaskVersioned: jest.fn(
              ({
                value: _value,
                mask: _mask,
+                workspaceId: _workspaceId,
              }: {
                value: string;
                mask: string;
+                workspaceId?: string;
              }) => '********',
            ),
          },
@@ -76,7 +82,7 @@ describe('ApplicationVariableEntityService', () => {
  });

  describe('update', () => {
-    it('should encrypt value when variable is secret', async () => {
+    it('should encrypt value with workspaceId-scoped envelope when variable is secret', async () => {
      const existingVariable = {
        id: '1',
        key: 'API_KEY',
@@ -95,12 +101,13 @@ describe('ApplicationVariableEntityService', () => {
        workspaceId: mockWorkspaceId,
      });

-      expect(secretEncryptionService.encrypt).toHaveBeenCalledWith(
+      expect(secretEncryptionService.encryptVersioned).toHaveBeenCalledWith(
        'new-secret-value',
+        { workspaceId: mockWorkspaceId },
      );
      expect(repository.update).toHaveBeenCalledWith(
        { key: 'API_KEY', applicationId: mockApplicationId },
-        { value: 'encrypted_new-secret-value' },
+        { value: `enc:v2:deadbeef:new-secret-value|${mockWorkspaceId}` },
      );
      expect(workspaceCacheService.invalidateAndRecompute).toHaveBeenCalledWith(
        mockWorkspaceId,
@@ -127,7 +134,7 @@ describe('ApplicationVariableEntityService', () => {
        workspaceId: mockWorkspaceId,
      });

-      expect(secretEncryptionService.encrypt).not.toHaveBeenCalled();
+      expect(secretEncryptionService.encryptVersioned).not.toHaveBeenCalled();
      expect(repository.update).toHaveBeenCalledWith(
        { key: 'PUBLIC_URL', applicationId: mockApplicationId },
        { value: 'https://new-url.com' },
@@ -167,28 +174,35 @@ describe('ApplicationVariableEntityService', () => {
        value: 'https://example.com',
        isSecret: false,
        applicationId: mockApplicationId,
+        workspaceId: mockWorkspaceId,
      } as ApplicationVariableEntity;

      const result = service.getDisplayValue(variable);

      expect(result).toBe('https://example.com');
-      expect(secretEncryptionService.decryptAndMask).not.toHaveBeenCalled();
+      expect(
+        secretEncryptionService.decryptAndMaskVersioned,
+      ).not.toHaveBeenCalled();
    });

-    it('should call decryptAndMask for secret variables', () => {
+    it('should call decryptAndMaskVersioned with the row workspaceId for secret variables', () => {
      const variable = {
        id: '1',
        key: 'SECRET_KEY',
-        value: 'encrypted_value',
+        value: 'enc:v2:deadbeef:secret|workspace-123',
        isSecret: true,
        applicationId: mockApplicationId,
+        workspaceId: mockWorkspaceId,
      } as ApplicationVariableEntity;

      service.getDisplayValue(variable);

-      expect(secretEncryptionService.decryptAndMask).toHaveBeenCalledWith({
-        value: 'encrypted_value',
+      expect(
+        secretEncryptionService.decryptAndMaskVersioned,
+      ).toHaveBeenCalledWith({
+        value: 'enc:v2:deadbeef:secret|workspace-123',
        mask: SECRET_APPLICATION_VARIABLE_MASK,
+        workspaceId: mockWorkspaceId,
      });
    });
  });
@@ -2,6 +2,7 @@ import { ObjectType } from '@nestjs/graphql';

 import { IDField } from '@ptc-org/nestjs-query-graphql';
 import {
+  Check,
  Column,
  CreateDateColumn,
  Entity,
@@ -17,6 +18,14 @@ import { SyncableEntity } from 'src/engine/workspace-manager/types/syncable-enti
  schema: 'core',
 })
@ObjectType('ApplicationVariable')
+// Constrains `value` for secret rows to the versioned envelope, while
+// leaving plaintext non-secret values untouched. The keyId portion is
+// not constrained so future ENCRYPTION_KEY rotations do not need a DDL
+// migration.
+@Check(
+  'CHK_applicationVariable_value_encrypted',
+  `"isSecret" = false OR "value" = '' OR "value" LIKE 'enc:v2:%'`,
+)
 export class ApplicationVariableEntity extends SyncableEntity {
  @IDField(() => UUIDScalarType)
  @PrimaryGeneratedColumn('uuid')
@@ -32,9 +32,10 @@ export class ApplicationVariableEntityService {
      return '';
    }

-    return this.secretEncryptionService.decryptAndMask({
+    return this.secretEncryptionService.decryptAndMaskVersioned({
      value: applicationVariable.value,
      mask: SECRET_APPLICATION_VARIABLE_MASK,
+      workspaceId: applicationVariable.workspaceId,
    });
  }

@@ -60,7 +61,9 @@ export class ApplicationVariableEntityService {
    }

    const encryptedValue = existingVariable.isSecret
-      ? this.secretEncryptionService.encrypt(plainTextValue)
+      ? this.secretEncryptionService.encryptVersioned(plainTextValue, {
+          workspaceId,
+        })
      : plainTextValue;

    await this.applicationVariableRepository.update(
@@ -53,7 +53,7 @@ export class ConnectionProviderService {
      variables.map((v) => [
        v.key,
        v.encryptedValue
-          ? this.secretEncryptionService.decrypt(v.encryptedValue)
+          ? this.secretEncryptionService.decryptVersioned(v.encryptedValue)
          : '',
      ]),
    );
@@ -1,4 +1,5 @@
 import {
+  Check,
  Column,
  CreateDateColumn,
  Entity,
@@ -12,6 +13,12 @@ import {
  unique: true,
  where: '"isCurrent" = true',
 })
+// Signing keys are instance-scoped — the HKDF info is just "instance"
+// — so the envelope shape is enforced on every non-null privateKey row.
+@Check(
+  'CHK_signingKey_privateKey_encrypted',
+  `"privateKey" IS NULL OR "privateKey" LIKE 'enc:v2:%'`,
+)
 export class SigningKeyEntity {
  @PrimaryGeneratedColumn('uuid')
  id: string;
@@ -106,7 +106,7 @@ export class JwtKeyManagerService {
      );
    }

-    return this.secretEncryptionService.decrypt(encryptedPrivateKey);
+    return this.secretEncryptionService.decryptVersioned(encryptedPrivateKey);
  }

  private async generateAndPersistCurrent(): Promise<CurrentSigningKey> {
@@ -117,7 +117,7 @@ export class JwtKeyManagerService {
      await this.signingKeyRepository.insert({
        id,
        publicKey: generated.publicKeyPem,
-        privateKey: this.secretEncryptionService.encrypt(
+        privateKey: this.secretEncryptionService.encryptVersioned(
          generated.privateKeyPem,
        ),
        isCurrent: true,
@@ -300,8 +300,13 @@ export class LogicFunctionExecutorService {
    // .updateVariable call encrypt unconditionally), independent of
    // `isSecret`. `isSecret` is display metadata — the storage contract is
    // not conditional, so decryption isn't either.
+    //
+    // Registration variables are server-level config — any installed
+    // application across any workspace must be able to read them — so they
+    // use the instance-scoped versioned envelope (no workspaceId in the HKDF
+    // info).
    for (const variable of serverVariables) {
-      envMap[variable.key] = this.secretEncryptionService.decrypt(
+      envMap[variable.key] = this.secretEncryptionService.decryptVersioned(
        variable.encryptedValue,
      );
    }
@@ -3,9 +3,18 @@ import { type SecretEncryptionService } from 'src/engine/core-modules/secret-enc
 import { buildEnvVar } from 'src/engine/core-modules/logic-function/logic-function-executor/utils/build-env-var';

 describe('buildEnvVar', () => {
+  const workspaceA = 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa';
+  const workspaceB = 'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb';
+
  const mockSecretEncryptionService = {
-    encrypt: jest.fn((value: string) => `encrypted_${value}`),
-    decrypt: jest.fn((value: string) => value.replace('encrypted_', '')),
+    encryptVersioned: jest.fn(
+      (value: string, opts?: { workspaceId?: string }) =>
+        `enc:v2:deadbeef:${value}|${opts?.workspaceId ?? 'instance'}`,
+    ),
+    decryptVersioned: jest.fn(
+      (value: string, _opts?: { workspaceId?: string }) =>
+        value.replace(/^enc:v2:[0-9a-f]+:/, '').replace(/\|.*$/, ''),
+    ),
  } as unknown as SecretEncryptionService;

  beforeEach(() => {
@@ -18,7 +27,7 @@ describe('buildEnvVar', () => {
    expect(result).toEqual({});
  });

-  it('should handle mixed secret and non-secret variables', () => {
+  it('should decrypt secret variables with the row workspaceId bound to HKDF', () => {
    const flatVariables: FlatApplicationVariable[] = [
      {
        id: '1',
@@ -27,7 +36,7 @@ describe('buildEnvVar', () => {
        description: 'Public URL',
        isSecret: false,
        applicationId: 'app-1',
-        workspaceId: '00000000-0000-0000-0000-000000000000',
+        workspaceId: workspaceA,
        universalIdentifier: '00000000-0000-0000-0000-000000000000',
        applicationUniversalIdentifier: '00000000-0000-0000-0000-000000000000',
        createdAt: '2024-01-01T00:00:00.000Z',
@@ -36,11 +45,11 @@ describe('buildEnvVar', () => {
      {
        id: '2',
        key: 'API_SECRET',
-        value: 'encrypted_secret-123',
+        value: `enc:v2:deadbeef:secret-123|${workspaceA}`,
        description: 'API secret',
        isSecret: true,
        applicationId: 'app-1',
-        workspaceId: '00000000-0000-0000-0000-000000000000',
+        workspaceId: workspaceA,
        universalIdentifier: '00000000-0000-0000-0000-000000000000',
        applicationUniversalIdentifier: '00000000-0000-0000-0000-000000000000',
        createdAt: '2024-01-01T00:00:00.000Z',
@@ -53,7 +62,7 @@ describe('buildEnvVar', () => {
        description: 'Debug flag',
        isSecret: false,
        applicationId: 'app-1',
-        workspaceId: '00000000-0000-0000-0000-000000000000',
+        workspaceId: workspaceA,
        universalIdentifier: '00000000-0000-0000-0000-000000000000',
        applicationUniversalIdentifier: '00000000-0000-0000-0000-000000000000',
        createdAt: '2024-01-01T00:00:00.000Z',
@@ -68,9 +77,54 @@ describe('buildEnvVar', () => {
      API_SECRET: 'secret-123',
      DEBUG: 'true',
    });
-    expect(mockSecretEncryptionService.decrypt).toHaveBeenCalledTimes(1);
-    expect(mockSecretEncryptionService.decrypt).toHaveBeenCalledWith(
-      'encrypted_secret-123',
+    expect(mockSecretEncryptionService.decryptVersioned).toHaveBeenCalledTimes(
+      1,
+    );
+    expect(mockSecretEncryptionService.decryptVersioned).toHaveBeenCalledWith(
+      `enc:v2:deadbeef:secret-123|${workspaceA}`,
+      { workspaceId: workspaceA },
+    );
+  });
+
+  it('routes each secret variable to its own workspace HKDF context', () => {
+    const flatVariables: FlatApplicationVariable[] = [
+      {
+        id: '1',
+        key: 'A_SECRET',
+        value: `enc:v2:deadbeef:value-a|${workspaceA}`,
+        description: '',
+        isSecret: true,
+        applicationId: 'app-1',
+        workspaceId: workspaceA,
+        universalIdentifier: '00000000-0000-0000-0000-000000000000',
+        applicationUniversalIdentifier: '00000000-0000-0000-0000-000000000000',
+        createdAt: '2024-01-01T00:00:00.000Z',
+        updatedAt: '2024-01-01T00:00:00.000Z',
+      },
+      {
+        id: '2',
+        key: 'B_SECRET',
+        value: `enc:v2:deadbeef:value-b|${workspaceB}`,
+        description: '',
+        isSecret: true,
+        applicationId: 'app-1',
+        workspaceId: workspaceB,
+        universalIdentifier: '00000000-0000-0000-0000-000000000000',
+        applicationUniversalIdentifier: '00000000-0000-0000-0000-000000000000',
+        createdAt: '2024-01-01T00:00:00.000Z',
+        updatedAt: '2024-01-01T00:00:00.000Z',
+      },
+    ];
+
+    buildEnvVar(flatVariables, mockSecretEncryptionService);
+
+    expect(mockSecretEncryptionService.decryptVersioned).toHaveBeenCalledWith(
+      `enc:v2:deadbeef:value-a|${workspaceA}`,
+      { workspaceId: workspaceA },
+    );
+    expect(mockSecretEncryptionService.decryptVersioned).toHaveBeenCalledWith(
+      `enc:v2:deadbeef:value-b|${workspaceB}`,
+      { workspaceId: workspaceB },
    );
  });

@@ -83,7 +137,7 @@ describe('buildEnvVar', () => {
        description: '',
        isSecret: false,
        applicationId: 'app-1',
-        workspaceId: '00000000-0000-0000-0000-000000000000',
+        workspaceId: workspaceA,
        universalIdentifier: '00000000-0000-0000-0000-000000000000',
        applicationUniversalIdentifier: '00000000-0000-0000-0000-000000000000',
        createdAt: '2024-01-01T00:00:00.000Z',
@@ -96,7 +150,7 @@ describe('buildEnvVar', () => {
        description: '',
        isSecret: false,
        applicationId: 'app-1',
-        workspaceId: '00000000-0000-0000-0000-000000000000',
+        workspaceId: workspaceA,
        universalIdentifier: '00000000-0000-0000-0000-000000000000',
        applicationUniversalIdentifier: '00000000-0000-0000-0000-000000000000',
        createdAt: '2024-01-01T00:00:00.000Z',
@@ -121,7 +175,7 @@ describe('buildEnvVar', () => {
        description: '',
        isSecret: false,
        applicationId: 'app-1',
-        workspaceId: '00000000-0000-0000-0000-000000000000',
+        workspaceId: workspaceA,
        universalIdentifier: '00000000-0000-0000-0000-000000000000',
        applicationUniversalIdentifier: '00000000-0000-0000-0000-000000000000',
        createdAt: '2024-01-01T00:00:00.000Z',
@@ -12,7 +12,9 @@ export const buildEnvVar = (

      acc[flatApplicationVariable.key] =
        flatApplicationVariable.isSecret && isNonEmptyString(value)
-          ? secretEncryptionService.decrypt(value)
+          ? secretEncryptionService.decryptVersioned(value, {
+              workspaceId: flatApplicationVariable.workspaceId,
+            })
          : value;

      return acc;
@@ -188,4 +188,51 @@ describe('SecretEncryptionService', () => {
      expect(result).toBe(mask);
    });
  });
+
+  describe('decryptAndMaskVersioned', () => {
+    const mask = '********';
+
+    it('round-trips a v2 envelope and applies the mask', () => {
+      const secret = 'sk-abcdefghij1234567890';
+      const encrypted = service.encryptVersioned(secret);
+
+      const result = service.decryptAndMaskVersioned({
+        value: encrypted,
+        mask,
+      });
+
+      // 23 chars, floor(23/10) = 2, min(5, 2) = 2 → first 2 chars + mask
+      expect(result).toBe(`sk${mask}`);
+    });
+
+    it('decrypts a workspace-scoped v2 envelope when given the matching workspaceId', () => {
+      const workspaceId = '11111111-1111-1111-1111-111111111111';
+      const secret = 'sk-workspace-bound-secret';
+      const encrypted = service.encryptVersioned(secret, { workspaceId });
+
+      const result = service.decryptAndMaskVersioned({
+        value: encrypted,
+        mask,
+        workspaceId,
+      });
+
+      // 25 chars, floor(25/10) = 2, min(5, 2) = 2 → first 2 chars + mask
+      expect(result).toBe(`sk${mask}`);
+    });
+
+    it('returns null/undefined values as-is', () => {
+      expect(
+        service.decryptAndMaskVersioned({
+          value: null as unknown as string,
+          mask,
+        }),
+      ).toBeNull();
+      expect(
+        service.decryptAndMaskVersioned({
+          value: undefined as unknown as string,
+          mask,
+        }),
+      ).toBeUndefined();
+    });
+  });
 });
@@ -65,7 +65,31 @@ export class SecretEncryptionService {
      return value;
    }

-    const decryptedValue = this.decrypt(value);
+    return this.maskDecryptedValue(this.decrypt(value), mask);
+  }
+
+  public decryptAndMaskVersioned({
+    value,
+    mask,
+    workspaceId,
+  }: {
+    value: string;
+    mask: string;
+    workspaceId?: string;
+  }): string {
+    if (!isDefined(value)) {
+      return value;
+    }
+
+    return this.maskDecryptedValue(
+      this.decryptVersioned(value, { workspaceId }),
+      mask,
+    );
+  }
+
+  private maskDecryptedValue(decryptedValue: string, mask: string): string {
+    // Visible-char count caps at 5 and at one-tenth of the secret length, so
+    // short secrets reveal nothing and longer secrets reveal a stable prefix.
    const visibleCharsCount = Math.min(
      5,
      Math.floor(decryptedValue.length / 10),
@@ -82,8 +82,8 @@ describe('ConfigStorageService', () => {
        {
          provide: SecretEncryptionService,
          useValue: {
-            decrypt: jest.fn((value) => value),
-            encrypt: jest.fn((value) => value),
+            decryptVersioned: jest.fn((value) => value),
+            encryptVersioned: jest.fn((value) => value),
          },
        },
      ],
@@ -198,7 +198,7 @@ describe('ConfigStorageService', () => {
      const result = await service.get(key);

      expect(result).toBe(originalValue);
-      expect(secretEncryptionService.decrypt).toHaveBeenCalledWith(
+      expect(secretEncryptionService.decryptVersioned).toHaveBeenCalledWith(
        encryptedValue,
      );
    });
@@ -399,7 +399,7 @@ describe('ConfigStorageService', () => {
        workspaceId: null,
        type: KeyValuePairType.CONFIG_VARIABLE,
      });
-      expect(secretEncryptionService.encrypt).toHaveBeenCalledWith(
+      expect(secretEncryptionService.encryptVersioned).toHaveBeenCalledWith(
        convertedValue,
      );
    });
@@ -570,7 +570,7 @@ describe('ConfigStorageService', () => {
      expect(result.get('NORMAL_CONFIG' as keyof ConfigVariables)).toBe(
        'normal-value',
      );
-      expect(secretEncryptionService.decrypt).toHaveBeenCalledWith(
+      expect(secretEncryptionService.decryptVersioned).toHaveBeenCalledWith(
        'sensitive-value',
      );
    });
@@ -70,8 +70,8 @@ export class ConfigStorageService implements ConfigStorageInterface {
      }

      return isDecrypt
-        ? this.secretEncryptionService.decrypt(convertedValue)
-        : this.secretEncryptionService.encrypt(convertedValue);
+        ? this.secretEncryptionService.decryptVersioned(convertedValue)
+        : this.secretEncryptionService.encryptVersioned(convertedValue);
    } catch (error) {
      throw new ConfigVariableException(
        `Failed to convert value for key ${key as string}: ${error.message}`,